Upgrade project keeper and dependencies (#56)

Author: kaklakariada

.gitattributes

@@ -7,4 +7,6 @@ doc/changes/changelog.md                     linguist-generated=true
 .github/workflows/broken_links_checker.yml   linguist-generated=true
 .github/workflows/project-keeper.sh          linguist-generated=true
 .github/workflows/project-keeper-verify.yml  linguist-generated=true
-SECURITY.md                                  linguist-generated=true
+.github/workflows/lint-github-actions.yml    linguist-generated=true
+.github/zizmor.yml                           linguist-generated=true
+SECURITY.md                                  linguist-generated=true

.github/workflows/broken_links_checker.yml

@@ -16,17 +16,20 @@ jobs:
       DEFAULT_TARGET: 'test:node'
     steps:
       - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
       - uses: actions/setup-node@v6
         with:
           node-version: '24'
           cache: 'npm'
-      - run: npm ci
+      - run: npm ci --ignore-scripts
       - run: npm run ${{ matrix.target }}
       - name: Run audit
         if: ${{ matrix.target == env.DEFAULT_TARGET }}
         run: npm run audit
       - name: SonarCloud Scan
-        uses: SonarSource/sonarqube-scan-action@v7
+        uses: SonarSource/sonarqube-scan-action@59db25f34e16620e48ab4bb9e4a5dce155cb5432 # v8.0.0
         if: ${{ matrix.target == env.DEFAULT_TARGET }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/ci-build.yml

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+set -o errexit
+set -o nounset
+
+script_path="$( cd "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )"
+
+root_dir="$script_path/../.."
+
+pushd "$root_dir" > /dev/null
+pwd
+exec "$script_path/oftw.sh" trace

.github/workflows/lint-github-actions.yml

@@ -0,0 +1,25 @@
+#!/bin/sh
+
+set -o errexit
+set -o nounset
+
+readonly version="4.4.0"
+readonly default_local_repo="${HOME}/.m2/repository"
+
+if [ -d "$default_local_repo" ]; then
+    local_repo="$default_local_repo"
+else
+    echo "Default local Maven repository not found at $default_local_repo. Attempting to determine it from Maven settings..."
+    local_repo=$(mvn help:evaluate -Dexpression=settings.localRepository -q -DforceStdout)
+fi
+readonly local_repo
+readonly jar_file="$local_repo/org/itsallcode/openfasttrace/openfasttrace/$version/openfasttrace-$version.jar"
+
+if [ ! -f "$jar_file" ]; then
+    echo "JAR file $jar_file not found in local Maven repository. Downloading it..."
+    mvn --batch-mode org.apache.maven.plugins:maven-dependency-plugin:3.10.0:get \
+        -Dartifact=org.itsallcode.openfasttrace:openfasttrace:"$version" \
+        -Dtransitive=false
+fi
+
+exec java -jar "$jar_file" "$@"

.github/workflows/oft-trace.sh

@@ -14,15 +14,18 @@ jobs:
       DEFAULT_TARGET: 'test:node'
     steps:
       - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
       - uses: actions/setup-node@v6
         with:
           node-version: '24'
           cache: 'npm'
-      - run: npm ci
+      - run: npm ci --ignore-scripts
       - run: npm run ${{ matrix.target }}
       - name: SonarCloud Scan
-        uses: SonarSource/sonarqube-scan-action@v7
-        if: ${{ matrix.target == env.DEFAULT_TARGET }}
+        uses: SonarSource/sonarqube-scan-action@59db25f34e16620e48ab4bb9e4a5dce155cb5432 # v8.0.0
+        if: ${{ matrix.target == env.DEFAULT_TARGET && env.SONAR_TOKEN != null }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
@@ -40,21 +43,42 @@ jobs:
     name: Node ${{ matrix.node }} integration test
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Setup node ${{ matrix.node }}
         uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
           cache: 'npm'
-      - run: npm ci
+      - run: npm ci --ignore-scripts
       - name: Run audit
         if: ${{ matrix.node == env.DEFAULT_NODE_VERSION }}
         run: npm run audit
       - run: npm run itest:dom
 
-  build:
+  trace-requirements:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-    needs: [distributed-tasks, integration-test-node]
+    strategy:
+      fail-fast: false
+    name: Trace requirements
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - name: Cache OFT JARs
+        uses: actions/cache@v5
+        with:
+          path: ~/.m2/repository/
+          key: oft-${{ hashFiles('.github/workflows/oftw.sh') }}
+          restore-keys: oft
+      - run: ./.github/workflows/oft-trace.sh
+
+  build:
+    runs-on: ubuntu-slim
+    permissions:
+      contents: read
+    needs: [distributed-tasks, integration-test-node, trace-requirements]
     steps:
       - run: echo "All checks passed, build successful!"

.github/workflows/oftw.sh

@@ -13,11 +13,13 @@ jobs:
         target: ['lint:ci', 'test:dom', 'test:node', 'itest:dom', 'itest:node']
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@v6
         with:
           node-version: '24'
           cache: 'npm'
-      - run: npm ci
+      - run: npm ci --ignore-scripts
       - run: npm run ${{ matrix.target }}
 
   release:
@@ -29,12 +31,14 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@v6
         with:
           node-version: '24'
           cache: 'npm'
           registry-url: 'https://registry.npmjs.org'
-      - run: npm ci
+      - run: npm ci --ignore-scripts
       - run: npm run audit
       - run: npm run build
       - run: npm pack